The web was built for eyes
Sometime in early June, a line was quietly crossed. For the first time in the internet's history, bots — not people — generated the majority of web traffic. And the fastest-growing slice isn't the old story of spam bots and scrapers. It's AI agents doing legitimate work on someone's behalf: researching, comparing, booking, buying, integrating.
The internet's typical user now has no eyes, no patience for design, and no interest in your cookie banner. That single fact quietly breaks most of the assumptions the web is built on.
Open any webpage and look at what actually travels over the wire: HTML structure, CSS styling, JavaScript, fonts, tracking pixels, ad slots, consent pop-ups. Almost all of it exists to render something pleasant for a human retina. When the reader is a model, all of that is pure waste — and now measurable waste.
Same article, two editions — cost to an AI reader
Cloudflare's measurement of a typical blog post: roughly 80% of the cost was packaging, not content. Across real-world pages the overhead runs 67–90%. Sites are starting to negotiate a machine edition automatically — same information, a fraction of the cost, and models comprehend it better.
Relax: the plumbing survives
Everyone in IT learned some version of the OSI stack. Good news — the bottom half is fine. Cables, IP addressing, routing, TCP and QUIC: agents send packets like everyone else. Nothing about AI changes how bits cross an ocean.
The change is all at the top. The application layer we knew — browsers fetching pages for people — is being hollowed out and rebuilt. Not a replacement of the internet, but a new stack growing on top of it, the way the web itself once grew on top of TCP/IP. Watching the standards bodies, vendors, and open-source foundations converge over the past eighteen months, I'd describe that new stack as five layers.
The stack, redrawn — new layers on old plumbing
What each layer actually does
-
L1Intent
Instead of fetching a page and reverse-engineering meaning from its layout, agents say what they want. MCP lets an agent call tools and services directly; A2A lets agents talk to each other. Both now sit under neutral Linux Foundation governance — the institutional signal that they're infrastructure, not products. Think of MCP as becoming for agents what HTTP was for browsers.
MCPA2ALinux Foundation -
L2Identity
"Are you human?" is a dying question — and with it, the CAPTCHA. The new question: which agent are you, who sent you, and what are you allowed to do? The emerging answer is cryptographic — agents sign requests with verifiable keys. Spoofable user-agent strings are ending; provable identity is arriving.
Web Bot Authsigned requestsIETF · Cloudflare · Akamai · AWS · OpenAI -
L3Delegation
An agent almost never acts for itself — it acts for a person or a company. So authorisation is being rebuilt around delegation chains: audit logs that read "Agent X, acting on behalf of Jane, accessed System Y with exactly these permissions." If you've worked with OAuth, this is OAuth growing up for a world where the client is autonomous.
delegation chainsscoped permissionsOAuth, grown up -
L4Payment
My favourite detail: HTTP has contained status code 402, "Payment Required", since the 1990s. It was never used. It's now being switched on. x402 lets a server quote a price and an agent pay it in milliseconds, fractions of a cent at a time, inside an ordinary web request — with Visa, Mastercard, Stripe, Google, and Cloudflare behind the foundation that launched this month.
x402HTTP 402micro-settlement -
L5Discovery
Crawling the web to find things is fantastically wasteful — over half of AI crawler traffic re-fetches pages that haven't changed. The replacement is registries: services publish signed, machine-readable capability cards, and agents look them up directly. There's even a serious MIT proposal for a DNS-like index built for billions of agents. Search engines crawl; agents will ask.
capability cardsregistriesNANDA · MIT
Attention gives way to settlement
The web's old bargain — free content in exchange for human attention on ads — collapses when the visitor has no eyes. Google's crawler historically fetched a handful of pages for every visitor it sent back to a site. AI crawlers fetch thousands per visitor sent. Something has to pay for the wire, and it won't be eyeballs.
Pages fetched per human visitor delivered
What doesn't change
IP, DNS, TCP, TLS, and HTTP aren't dying. They're becoming plumbing — invisible substrate beneath the agent layers, exactly the way IPv4 still quietly carries traffic decades into the IPv6 transition. Anyone selling you "the death of HTTP" is selling something else too.
What this means for you on Monday
Non-human identities already outnumber your humans. Treat them as first-class citizens: short-lived credentials, provable identity, no shared API keys in config files.
Offer your content and APIs in machine-legible form — structured, clean, negotiable. It's 70–90% cheaper for the agents consuming it, and understood more accurately.
Learn MCP the way you once learned REST. It's the interface your services will be consumed through.
When most of your consumers are machines, cost governance, quotas, and chargeback stop being finance concerns and become architecture concerns.
Security moves inside the execution. Less perimeter, more sandbox: scoped permissions, isolated runtimes, auditable delegation — built into how agents run, not bolted on around them.
I've spent years arguing that the real bottleneck in software isn't syntax — it's clarity of intent. The internet is now making the same argument at planetary scale.
We spent thirty years optimising how machines render pages for human eyes. The next decade is about how machines exchange intent with each other — signed, authorised, priced, and settled in milliseconds.
The web isn't dying. It's shedding its packaging.
What's the first thing you'd change in your stack if you knew half your traffic had no eyes? I'd genuinely like to hear it.